Our organization has received several copyright complaints that we are distributing illegal material via bitTorrent. Obviously we do not condone this activity and we would like to stop this. I have Wireshark running and can see five users running a version of the bitTorrent client, but bitTorrent itself isn't the problem.

So, what I need to know is this. How can we prove that the particular IP's we are auditing are sharing these files? I am running Wireshark and capturing all packets for now on the said IP's, but what else do I need to do to make sure I get the right people and have a rock solid case?

I searched online but there is very little information on this, from what I have found. I could be searching for the wrong stuff though.